Heisenberg-limited eavesdropping on the continuous-variable 
quantum cryptographic protocol with no basis switching is impossible 
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The Gaussian quantum key distribution protocol based on coherent states and heterodyne detec- 
tion [Phys. Rev. Lett. 93, 170504 (2004)] has the advantage that no active random basis switching 
is needed on the receiver's side. Rs security is, however, not very satisfyingly understood today 
because the bounds on the secret key rate that have been derived from Heisenberg relations are 
not attained by any known scheme. Here, we address the problem of the optimal Gaussian indi- 
vidual attack against this protocol, and derive tight upper bounds on the information accessible to 
an eavesdropper. The optical scheme achieving this bound is also exhibited, which concludes the 
security analysis of this protocol. 

PACS numbers: 03.67.Dd, 42.50.-p, 89.70.+C 



I. INTRODUCTION 

Over the past few years, an important research ef- 
fort has been devoted to continuous-variable quantum 
key distribution (QKD) protocols, motivated by the 
prospects of realizing high-rate cryptosystems relying on 
homodyne detection instead of photon counting. These 
systems also have the advantage that they are based on 
standard (low-cost) telecom optical components, circum- 
venting the need for single-photon sources nor single- 
photon detectors. In particular, Gaussian QKD proto- 
cols have been extensively investigated first because they 
are conceptually simpler, but also mainly because their 
security can be rigorously assessed. The first proposed 
Gaussian QKD protocol used squeezed states of light, 
which arc modulated in one or the other quadrature (x 
or p) by the emitter (Alice), and are measured via ho- 
modyne detection by the receiver (Bob) 0. Although 
this protocol is a very natural continuous-variable coun- 
terpart of the famous BB84 protocol, its main drawback 
is the need for a source of squeezed light. 

A second Gaussian QKD protocol was devised, 
in which Alice generates coherent states (instead of 
squeezed states) which are then modulated both in x 
and p, while Bob still performs homodyne detection • 
Dealing with coherent states of light (simply produced 
with a laser) instead of squeezed or single-photon states 
makes this protocol very practical. This protocol, sup- 
plemented with the technique of reverse reconciliation, 
was experimentally demonstrated in Ref. [||, where it 
was shown that its range can, in principle, be arbitrar- 
ily large. Note that, in these two protocols, Bob ran- 
domly chooses to homodyning one quadrature, either x 
or p. In the squeezed-state protocol, Bob then needs to 
reject the instances where he measured the other quadra- 
ture than the one modulated by Alice (this operation is 
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called sifting) , which results in a decrease of the key rate 
by a factor 2 [T3|. In the coherent-state protocol, Alice 
simply forgets the quadrature that is not measured by 
Bob, which may look like a loss of efficiency. A third 
Gaussian protocol was therefore proposed, in which Al- 
ice still transmits doubly-modulated coherent states but 
Bob performs heterodyne measurements, that is, he mea- 
sures both quadratures x and p simultaneously [4j] (this 
possibilitywas also suggested for postselection-based pro- 
tocols in Q). At first sight, this seems to imply that the 
rate is doubled, since Bob then acquires a pair of quadra- 
tures (x,p). Actually, since heterodyne measurement ef- 
fects one additional unit of vacuum noise on the mea- 
sured quadratures, the two quadratures received by Bob 
are noisier than the single quadrature in the homodync- 
based protocol. The net effect, however, is generally an 
increase of the key rate when the two quadratures are 
measured simultaneously fl4| . 

This third protocol thus exhibits two advantages, 
namely that (i) the key rate is generally higher than 
for the homodyne-based coherent-state protocol, and (ii) 
there is no need to choose a random quadrature (i.e., 
no active basis choice is needed) at Bob's side. How- 
ever, in order to make any definite statement on the se- 
curity of this protocol, it is necessary to put precise limits 
on the maximum information accessible to an eavesdrop- 
per (Eve). Surprisingly, although bounds on the opti- 
mal Gaussian individual attack against this protocol had 
been derived in it has remained unknown until now 
whether these bounds can be attained or not by an ex- 
plicit eavesdropping strategy. These bounds were derived 
using similar techniques to those used for the other Gaus- 
sian protocols, namely by writing Heisenberg uncertainty 
relations. Since for the protocols based on homodyne 
detection, the corresponding Heisenberg bounds can be 
attained by use of an explicit transformation (the entan- 
gling doner), it is tempting to conclude that the same 
is true for the heterodyne-based protocol. On the other 
hand, since no explicit scheme has been found to date 
that saturates these bounds, another possibility is that 
these are loose, and tighter bounds remain to be found. 
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In this paper, we revisit the security of this coherent- 
state heterodyne-based Gaussian protocol, and prove 
that the second above option is indeed true. We seek 
for the optimal Gaussian individual attack by express- 
ing the most general symplectic transformation charac- 
terizing Eve's action and maximizing the information ac- 
quired by her. Restricting to symplectic transformations 
is actually sufficient given that Gaussian attacks are prov- 
ably optimal among individual attacks @. We conclude 
that this optimal attack is less powerful than expected, 
in the sense that we derive a tighter bound than that 
based on the Heisenberg inequalities. We also exhibit 
optical schemes that precisely attain this bound, both 
in direct and reverse reconciliation. Hence, the resulting 
lower bound on the secret key rate is higher than that 
based on the Heisenberg uncertainty relations, making 
the heterodyne-based protocol even more efficient than 
originally thought. 



II. HEISENBERG-LIMITED EAVESDROPPING 

The Gaussian protocol based on coherent states and 
heterodyne detection [i| can be shown to be equivalent to 
an entanglement-based scheme 0], where Alice prepares 
an EPR state and applies an heterodyne measurement on 
mode A, while Bob applies an heterodyne measurement 
on mode B. This is shown in Fig. Q] We restrict our- 
selves to individual attacks, where Eve completely con- 
trols the Alice-to-Bob channel separately for each trans- 
mitted state. Since Gaussian attacks are optimal among 
these attacks, we consider in what follows that Eve ef- 
fects a Gaussian channel [l5j]. Consequently, the quan- 
tum state pab before Alice and Bob's measurements can 
be assumed to be a Gaussian two-mode state with a zero 
mean value and a covariance matrix jab- Usual Gaus- 
sian channels, such as optical fibers, effect a symmetric 
and uncorrelated noise in both quadratures x and p (in- 
cluding, of course, the loss- induced noise), so that we 
will only consider symmetric channels without x-p corre- 
lations in what follows. Since the EPR state (two-mode 
squeezed state) is also symmetric and exhibits no cor- 
relations between x and p, we can write the resulting 
covariance matrix in a block-diagonal form as 



1AB 



Tab 







Tab 



with 



x(p) 
lAB 



V 



±vnv 2 - 1) 

±^T{V 2 - 1) T(V + X ) 



(1) 



(2) 



where the signs + and — correspond to Tab an( ^ Iab^ re ~ 
spectively. Here, V is the variance of Alice's output ther- 
mal state, while T and \ = (1 — T)/T + e are the trans- 
mittance and noise referred to the input of the Gaussian 
channel [the term (1 — T)/T stands for the loss-induced 
vacuum noise, while e is the excess noise referred to the 
input] . 




FIG. 1: Entanglement-based scheme of the protocol based 
on Alice sending coherent states and Bob applying hetero- 
dyne detection. Alice prepares an EPR state and applies het- 
erodyne detection on one half of it, resulting in (Xa ,Pa), 
while the other half is sent to Bob. After transmission via 
the channel, Bob performs an heterodyne measurement, re- 
sulting in (Xg,Pg ). The superscript (0) indicates that the 
corresponding state is the vacuum. 



In order to address the security of this protocol, we 
may, without loss of generality, assume that Eve holds 
the purification of the quantum state pab- By measuring 
their systems, Bob and Eve then project Alice's share of 
the joint pure state \^abe) onto another pure state[lj|. 
Applying the Heisenberg uncertainty relation on the pure 
state held by Alice (conditioning on Bob and Eve's mea- 
surements), we have 



Vx a \eV Pa \ b > 1, 



(3) 



where Xa and Pa are the canonically conjugate quadra- 
tures of Alice's mode and Vx\y is the conditional vari- 
ance measuring the remaining uncertainty on X after the 
measurement of Y, 



V: 



X\Y 



(y 2 ) 



(4) 



expressed in shot-noise units. Equation ([3]) also has a 
symmetric counterpart that reads, 



V Pa \ e Vx a \b > 1- 



(5) 



Since we focus on a symmetric noise in x and p, Eqs. ([3]) 
and {5} can be unified into a single uncertainty relation 



Va\eVa\b > 1- 



(6) 



where A stands for any quadrature (Xa or Pa) of Alice's 
mode. This inequality will be used to put a lower bound 
on the uncertainty of Eve's estimate of the key in Direct 
Reconciliation (DR), that is, when the key is made out of 
Alice's data while Bob and Eve compete to estimate it. 
Similarly, in Reverse Reconciliation (RR), that is, when 
the key is made out of Bob's data while Alice and Eve 
compete to estimate it, one can derive a dual inequality 



Vb\eVb\a > 1- 



(7) 



where B stands for any quadrature of Bob's mode. This 
will be used to put a lower bound on the uncertainty of 
Eve's estimate of the key in RR. 
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Now, we will derive lower bounds on the secret key 
rates using the above uncertainty relations on the vari- 
ances, similarly as in Ref. Restricting to individual 
attacks and one-way reconciliation, the DR and RR se- 
cret key rates for each of the two quadratures read 



x or p 



K 



RR 



H(A M \E)~ H(A M \B M ), 
H{B M \E)-H{B M \A M ), 



(8) 
(9) 



where H(.) is the Shannon entropy and E stands for 
Eve's optimal measurement maximizing her information 
(which is not necessarily the same in DR and RR). Note 
that we use the variables A M and B M here (not A and 
B), since in this protocol Alice and Bob do not measure 
one single quadrature but a pair of conjugate quadratures 
[A M (B ) stands for the measurement of one quadrature 
of mode A (B), given that the conjugate quadrature is 
simultaneously measured]. The total key rates Kf^p) or 
"^jfp) derived later on are the sum of the above expres- 
sions for x and p. If we assume that the channel is Gaus- 
sian, we can express the conditional entropies in Eqs. (J8]) 
and © in terms of conditional variances, so that the 
above Heisenberg inequalities on conditional variances di- 
rectly translate into bounds on the secret key rates. 



A. Direct reconciliation 

The problem of estimating Bob's uncertainty on Alice's 
measurements A M (that is, Xff or Pjf knowing that the 
other one is also measured) can be reduced to estimating 
Bob's uncertainty on each of the quadratures of mode A 
(Xa, Pa) since Alice's measurements result from mixing 
mode A with vacuum on a balanced beam splitter, see 
Fig. [2 Using Eqs. ([T]) and Q, one gets 



Va\b — 



v + x 



(10) 



where B stands for the same quadrature of mode B 
(X B or P B ). Similarly using Eq. and the fact 
that ((Xjf) 2 ) = (1 + ((Xb) 2 ))/2 and {X A Xg) = 
(X A X B ))/V2, one gets 



V, 



A\B» 



T(V X + l) + V 
T(V + X ) + l 



(11) 



which can then be converted into the variance of Bob's 
estimate of Alice's key 



V A m\b m 



V, 



1 



A\B- 

l r (F + l)(T(\ -!-!)-!■ I) 
2 



T(V + X ) + l 



(12) 



Using Va\e = 1/Va\b f° r the optimal eavesdropping 
(since Bob may have performed homodyne detection and 



measured one single quadrature), one gets for Eve's un- 
certainty on her estimate of Alice's key 



V, 



1 



A M \E — 2 
1 

~~ 2 



1 



1 



Va\b 

(v + i)(x + i) 



v x + i 

The secret key rate then reads, 

V A m\ E 



(13) 



K, 



DR 

0,p) 



= log 



log 



U 



A M \B M 



(X + 1)(T(V + X) + 1) 
(U X +1)(T( X +1) + 1) 



(14) 



Note that we have a factor two with respect to Eq. 
because the key is extracted from both quadratures X 
and Pf . 



hi 



B. Reverse reconciliation 



Similarly one can show that Vb\a = T(x + 1/U) and 
Vb\a m = ^(x+l)i s ° that the variance of Alice's estimate 
of Bob's data is 



B \A 



l r 

2 



V, 



B\A M 



1 r 

2 



T(x+1) + 1 



(15) 



while, using Vb\e = 1/Vb\a (Alice may have performed 
homodyne instead of heterodyne detection), one gets for 
Eve's uncertainty 



V, 



B \E 



1 



V, 



1 



B\A 



T(V X +l) + V 



T(V X + l) 



(16) 



The secret key rate then reads, 

V B M\ E 



ft-RR 



log 



B M \A M 



= log 



T(V X + 1) + V 
T(Ux + l)(T(x+l) + l) 



(17) 



We have a factor two with respect to Eq. ((9J because the 
key is extracted from both quadratures Xg and P B . 



III. OPTIMAL GAUSSIAN EAVESDROPPING 

The entangling doner, that is, the optimal attack 
against the homodyne-based protocols p}, is clearly not 
optimal here as it allows to extract information about 
one single quadrature. We may think of adapting it by 
applying an heterodyne detection on the mode that is 
entangled with the mode injected in the line (as well as 
on the output mode of Eve's beamsplitter simulating the 
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losses). However, this is equivalent to having a classi- 
cal source of noise controlled by Eve, so that the optimal 
Va(b)\e that Eve can reach coincides with the beamsplit- 
ter attack, which does not saturate (fT4"|) nor (TTTj) as the 
excess noise e only affects Alice and Bob mutual infor- 
mation but does not help Eve to reduce any uncertainty. 

Since the time when the heterodyne-based protocol 
was introduced [4j, no attack has been found saturat- 
ing bounds (fl4|) and (fT7|) . Logically, two possibilities 
remain open: (i) these bounds are tight but the opti- 
mal attacks reaching them remain to be found; (ii) these 
bound are not tight and the (unknown) optimal attacks 
can not saturate them. In order to answer this question, 
we need to search for the optimal attack against this pro- 
tocol with respect to all possible (individual Gaussian) 
attacks that Eve can do. Although we are dealing with 
an infinite-dimensional Hilbert space, this task remains 
tractable because of the fact that Gaussian states and op- 
erations have a simple characterization in terms of first- 
and second-order moments of the quadratures. We thus 
need to find among all possible linear canonical transfor- 
mations the one which optimizes Eve's information either 
on Alice's data (DR) or on Bob's data (RR). Some sym- 
metries also simplify the solution of this problem. Before 
searching for the optimal attack, let us consider these 
simplifications. 



1. Eve's Gaussian attack and the number of ancillae 

As we restrict Eve's attacks to Gaussian operations, 
it is trivial to see that Eve must apply a Gaussian uni- 
tary transformation on the mode sent by Alice together 
with her ancillae, as shown in Fig. O Indeed, applying a 
Gaussian completely positive maps instead of a unitary 
operation (i.e., discarding some ancillae) can only make 
Eve loose information on the secret key. The number of 
ancillae that Eve needs is determined as follows. First, it 
is easy to see that Eve needs at least two ancillary modes 
to estimate either Alice's (DR) or Bob's (RR) quadra- 
tures, since one is needed to get x, the other to get p. Let 
us give an argument why these two ancillary modes are 
actually sufficient to implement the optimal attack. In 
the entanglement-based description, Eve holds the purifi- 
cation of pab, and therefore can be restricted to occupy 
the same number of modes as pab, see 0. One should 
then be able to recover the entanglement-based scheme 
of Fig. [2] by applying a local unitary operation on Eve's 
side, since all purifications are equivalent up to a unitary 
operation on Eve's side. 

Thus, the optimal Gaussian attack we seek for corre- 
sponds, in the Heisenberg picture, to a symplectic trans- 
formation S acting jointly on Alice's mode Bq and Eve's 
ancillary modes E\ and Ei, that is 

[x B , x El , x E2 ,Pb , Pe 1 ,Pe 2 ] T = 

S [XBo , XeI . i PBo , PeI > P { E 2 f' ( 18 ) 



Eve 




FIG. 2: Eve's attack against the protocol based on Alice send- 
ing coherent states and Bob applying heterodyne detection. 
Eve performs a unitary operation on her two ancillae E\ and 
E2 together with the mode Bo sent by Alice. She then mea- 
sures x on one ancilla and p on the other one, in order to 
estimate simultaneously the two conjugate quadratures of Al- 
ice (DR) or Bob (RR). 

where the superscript (0) is used to indicate that the 
corresponding state is the vacuum. Then, Eve's opti- 
mal measurement on her two modes E = E\Ei can be 
assumed to be a homodyne measurement on these two 
modes in order to estimate either (xa,Pa) in DR or 
(x b ,Pb) in RR. 

2. Symmetric channel without x-p correlations 

The symplectic transformation S can be written with- 
out loss of generality in a bloc-diagonal form as 



where S x and S p are related by the relation 

S p = (Sj)- 1 (20) 

in order to preserve the canonical commutation relations. 
Indeed, we start with an initial Gaussian state of covari- 
ance matrix ^ab ® ^ El E 2 , which is of the same form 
as Eq. ([T]). More precisely, it is symmetric in x and p 
and admits no correlations between x and p. After Eve's 
Gaussian operation, we have a Gaussian state for modes 
A and B, which, by Schmidt decomposition, can be pu- 
rified into a Gaussian 4-mode state by extending the sys- 
tem with modes E\ and E% ||]. This can be understood 
by applying a symplectic decomposition on modes A and 
B that converts their joint state into a product of two 
thermal states. These thermal states can then be writ- 
ten as the reduction of EPR states, shared with Eve's 
modes E\ and E%. Since this symplectic decomposition 
does not mix the x and p quadratures, the covariance ma- 
trix of the 4-mode pure state is again of the same form as 
Eq. |T]). Hence, the symplectic transformation S applied 
by the eavesdropper does not mix the x and p quadra- 
tures. We would like to stress that this form, Eq. (fT^|) . 
is not an assumption but rather a simplification origi- 
nating from the fact that the channels of interest effect 
symmetric uncorrelated noise in x and p, as mentioned 
above. 
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The entry of the matrix corresponding to {x 2 B ) = 
T(V+x) provides constraints on the first row of S x , since 
we need to have 

x B = VT(x Bo + ^cos9 + sin 9 ) (21) 

where 9 G [0, 27r] is a free parameter. Remember that 
(x% g ) = (x\) = V. Thus, wc can write S x in general as 

(22) 



1 Vxcosf \/x s ' m 
T | a b c 

s t 



where {a,6, c, r, s,t} S K are six other free parameters. 
Using Equation (|20p . we can rewrite S p as 



and plugging them into Eq. ([4]), we obtain 

V 



V; 



Xa\X E i 



b 2 +c 2 



Similarly, one has for the p quadrature 



v, 



Pa\Pe2 



Finally, as a consequence of Eq. ([25]) we can write 



V A \i 



V + p 

Vp + r 



(29) 



(30) 



(31) 



where 



( bt — cs 

y/x(s sin 9 — t cos ( 
y/x(c cos 9 — b sin t 



V 



cr — at as — br \ 

t — r^Jxsm-9 r^/xcos9 — s 
a Vx sm — c b — a^Jx cos 9 

(23) 



where d = det(5 , a; ). Given the symmetry of the channel, 
the entry of j^b corresponding to (p B ) — T(V + x) P ro ~ 
vides a constraint on the first row of 5* p , in a similar way 
as for S x . This yields the three conditions 



bt-cs = dT 

cr — at = dT^xcosc 

as — br = dTy/xsiiK, 



(24) 



where <j> £ [0, 2w] is a free parameter. Finally, due to the 
symmetry of the channel in x and p, we consider that 
Eve's optimal attack gives her the same uncertainty in x 
and p. 



A. Direct reconciliation 

As before, Eve's uncertainty on Alice's measurements 
A M = (XX^Pa ) can be calculated from the un- 
certainty of Eve on each of the two quadratures of 
mode A (Xa,Pa)- We have, for example, Vx M \x E = 
\{Vx A \x Bl + 1)' an d similarly for the p quadrature. The 
symmetry of Eve's information on Xa and Pa imposes 
that 



Vx A \X El - Vp a \Pe 2 = V A\E- 

Writing the second-order moments of A and E\ , 
V 



(25) 



(26) 

(x%J = T(a 2 V + b 2 + c 2 ) (27) 
x A x El ) = aVT(x A x Bo ) = a^T(V 2 - 1) (28) 



P 



b 2 + c? s' 2 + f' 2 



(32) 



Given Eq. (f2"Tj) . we see that p is proportional to the signal- 
to-noise ratio of the Alice-to-Eve channel (more precisely, 
the latter signal-to- noise ratio equals pV). Thus, by def- 
inition, p > 0. Moreover, we can write in analogy with 
Eq. the Heisenberg uncertainty relation 



V Xa \X Ei V Pa\Pe 2 > 1 



(33) 



which, together with Eq. (|25[) . implies that Va\e ^ 1; 
or, equivalently, p < 1. Note that the Heisenberg-limitcd 
attack in DR corresponds simply to choose p = X- 

We will now prove that such a choice is not possible, 
that is, it is not consistent with the constraints we have 
on the matrices S x and S p . In order to further simplify 
S x , we introduce the following change of variables, 

a = Uyjp 
b = u sin £ 

c = it cos £ (34) 



Using the variables r', s', t' as defined in Eq. (|2"3"j) and the 
expression of p in terms of these variables, Eq. (f32|) . we 
then obtain 



x-p 



cos 2 (£ + 0)= (sin(£ + 0)-VPX 



(35) 



Using the symmetry of the channel, Eq. (f24|) . and the 
explicit expression of d = det S x , we obtain a second 
similar equation 



sin(£ + 9) + 



1 — T 

tVpx 



, (36) 



Expressing the equality between Eqs. (|35|) and (|36|) yields 
two solutions. The first one, namely = — (1 — T)/T, 
is unphysical since T < 1, p > 0, and x > 0. The second 
one yields 



sin(C + 9) 



1 T XP -(1-T) 
2 T^XP 



(37) 
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and the lower bound on the DR secret key rate reads 



K 



DR. 



log 



= log 



V A M \E 



V. 



A M \B" 



(p+ + i)(r(y + x) + i) 

(Vp + + 1)(T( X + 1) + 1) 



(42) 



FIG. 3: Secret key rate as a function of the line losses for 
the optimal (solid line) and Heisenberg-limited (dashed line) 
attack. The curves are plotted for experimentally realistic 
values, V — 12 and e = 0.01, in direct reconciliation (left 
panel) or reverse reconciliation (right panel). 



Furthermore, injecting Eq. (|37|) into Eq. (|36p gives 

cos^ + ^fl^+^y. (38) 

Finally, the relation cos 2 (£ + 9) + sin 2 (£ + 9) = 1 provides 
us with a second-order equation in p, 

T(T X 2 + 4:)p 2 - 2 X T(T + l)p + (1 - T f = (39) 

which always admits two solutions for a given channel 
(i.e. given parameters T and x)i 



X r(r + i)±2 v /r[(r x ) 2 -(i-r) 2 ] 

P± = T(T X 2 + 4) ' (40) 

Looking at Eq. {51]), we see that minimizing Va\e 
is equivalent to maximizing p, that is, choosing p + . 
Thus, Eve's minimum uncertainty on Alice's measure- 
ment reads, 



1 



V-min 
A M \E — 2 l y A\E 



[VI 



1] = i(K+lfe±l) (41) 

I 



Interestingly, Eq. (|4"Tj) is similar to its counterpart for the 
Heisenberg-limited attack, Eq. (fT3")) . but with p + replac- 
ing x- It can easily be checked that p + < x, so that 
the highest possible signal-to-noise ratio of the Alice-to- 
Eve channel is strictly lower than the one deduced from 
Heisenberg uncertainty relations. Hence, Eve's optimal 
attack is less powerful than expected from Heisenberg 
relations. 

This is illustrated in Fig. [3J where the secret key rates 
have been plotted for experimental realistic values of V 
and e. The lower bound deduced from the Heisenberg 
relations is satisfied, but loose with respect to the actual 
key rate. 

B. Reverse reconciliation 



Combining Eqs. (fl~8|) and (|22|) . we obtain the second- 
order moments of B and E\ 



T(V + X ) (43) 
T{a 2 V + b 2 + c 2 ) (44) 
T(aV + VX cos + c Vx sin 6) (45) 



(x B x El ) 



This results in 



V; 



Xb \ Xei 



= T 



h ^f-+X - ^(bcosO + csm8)]v + ^(bsin6 - ccos 



where we have used Eq. Similarly, using the symmetry of the channel, Eq. we can write, 

+ X - ^ W cos 4> + t' sin <j>)]v + ^{s' sin - H cos 4>f 

V Pb\P E 2 = T 



I 



(46) 



(47) 



Imposing the symmetry of Eve's information on Xb 
and Pb in analogy with Eq. (|25|) . that is, 



V: 



Xb\Xe\ 



v, 



Pb\Pe 



v, 



B\E, 



(48) 



gives the three conditions 



t' 2 b 2 



= P 



s' cos 4> + t' sin (j) bcos9 + cs'm9 sin(£ + #) 

= = VP 

cos(e + 9) 



r a 
s' sin 4> — t' cos <fi b sin 9 — c cos ( 
r' a 



V~p 



(49) 
(50) 

(51) 
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Note that condition (|49|) is exactly the same as in direct 
reconciliation. Surprisingly, it so happens that this con- 
dition is sufficient to find an expression for Vb\e which 
is the same as in direct reconciliation, making it unnec- 
essary to use the other two conditions. Indeed, Eve's 
uncertainty on the quadratures of mode B can be rewrit- 
ten as 



V b \e = T 



[I+XP- 2Vxpsin(£ + 9)] V + xcos 2 (£ + g) 
Vp+1 

Then, using the definition of sin(£ + 9) coming from 
Eq. ((371) as well as E q- (EH), we obtain 



cos 2 (£ + 0) = JL 



2Vxpsin(^ + 0) = l/T 



(53) 
(54) 



which gives Vb\e — Va\e- Therefore, just like in direct 
reconciliation, Eve's uncertainty on the quadratures of 
mode B is minimized by choosing p + , 



B\E 



V + P+ 
Vp, 



1 



(55) 



Then, Eve's uncertainty on Bob's measured values be- 
comes 



T/min 
B M \ E 



T/min 
V B\E 



1 



i(v + i)( P+ + i) 



2 Vp+ 
so that the RR secret key rate reads 



(56) 




12 3 
Channel Losses (dB) 



10 



S 10" 



10 



12 3 4 
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FIG. 4: Secret key rate as a function of the line losses for the 
heterodyne-based (solid line) and homodyne-based (dashed 
line) protocols in direct reconciliation (left panel) or reverse 
reconciliation (right panel). We use experimentally realistic 
values, V = 12 and e = 0.01, and consider that Alice sends 
coherent states in both cases. 



IV. OPTICAL SETUP ACHIEVING THE BEST 
GAUSSIAN ATTACK 

In Section III, we have reduced the problem of maxi- 
mizing Eve's information to that of optimizing a single 
parameter p, the other parameters remaining free. This 
implies that the optical implementation of the best Gaus- 
sian attack is not unique. In this Section, we present two 
particularly interesting examples of such an optical im- 
plementation, namely the teleportation attack and the 
"feed-forward" attack. Note that the latter attack was 
also considered in Ref. [3], where it was noticed that it 
curiously does not reach the Heisenberg limit. 



i^ RR = log 



log 



T/min 
V B M \E 



B M \A M 



(V + l)(p+ + l) 
(Vp+ + l)(T(x + l) + l) 



(57) 



This rate is illustrated in Fig. [3J where it is compared 
with the lower bound deduced from the Heisenberg re- 
lations in RR. We conclude again that the Heisenberg- 
limited attack is not reachable. 

For illustration, we compare in Fig. [4] the secret key 
rate of the coherent-state homodyne-based protocol to 
that of the present coherent-state heterodyne-based pro- 
tocol in direct and reverse reconciliation [Eqs. |42|) and 
(157)) ]. For realistic parameters V and e, we notice that 
the heterodyne-based protocol always yields higher rates 
than the homodyne-based protocol in RR. This also 
means that the maximum tolerable excess noise e in RR 
is higher with the heterodyne-based protocol regardless 
the losses. In DR, the heterodyne-based protocol gives 
an advantage over the homodyne-based protocol only for 
line losses below some threshold. This threshold can be 
shown to decrease for increasing e, so that the maximum 
tolerable noise is actually higher for the homodyne-based 
protocol in DR. 



A. Teleportation attack 

The teleportation attack consists in Eve applying a 
continuous- variable quantum teleportation where the in- 
put is Alice's outgoing mode and the output is given to 
Bob, as shown in Fig. [5] Eve extracts information from 
the outcomes (AT|f,Pj; f ) of her Bell measurement per- 
formed on Alice's outgoing mode Bq together with one 
of the modes (E[) of an EPR state. It is easy to see 
that there are two limiting cases. If the squeezing fac- 
tor r of the EPR pair is zero, implying that E[ is in 
a vacuum state, then the scheme becomes equivalent to 
an heterodyne measurement of Bq by Eve followed by 
the classical preparation of a coherent state (the vacuum 
state in mode E' 2 which is displaced by some amount de- 
pending on Xjf and P^f). This situation corresponds to 
an entanglement-breaking channel giving no secret key. 
On the contrary, if the squeezing factor r is infinite, the 
teleportation succeeds perfectly and Eve gets no informa- 
tion at all due to the infinite noise in the thermal state 
E[ . This situation corresponds to a perfect channel with 
no losses and no excess noise (T = l,e = 0). We will 
now show that for any intermediate value of r, such a 
teleportation attack can be made optimal. 

Since all the involved canonical transformations are 
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FIG. 5: Teleportation attack against the (entanglement-based 
scheme of the) Gaussian protocol based on Alice sending co- 
herent states and Bob applying heterodyne detection. Eve 
first generates an EPR pair (E^E^) by mixing a :r-squeezed 
vacuum state (E2) with a p-squeezed vacuum state (E\) at a 
balanced beamsplitter. Then, she performs a Bell measure- 
ment on Alice's outgoing mode Bo together with E[. Depend- 
ing on the measurement outcome and the fixed gain gE, she 
then displaces mode E' 2 by x (D x ) and p (-Dp). The result- 
ing state is sent to Bob. By tuning the squeezing parameter 
r and the gain gE, Eve can simulate any Gaussian channel 
(T, x) and extract the optimal amount of information. 



symmetric in x and p, we will detail the proof for the 
x quadrature only. Eve starts by preparing two squeezed 
vacuum states, one in mode E 2 (squeezed in x) and the 
other is mode E\ (squeezed in p), 



■i-2 



r -(0) 

e x\ ' 

„-r A (°) 



2 ) 



(58) 
(59) 



and mixes them on a balanced beamsplitter, thereby gen- 
erating an EPR state 



1. Direct reconciliation. 

Writing the second-order moments of xa and 
namely 



(4) = v 

(x%) = (F + cosh2r)/2 



(66) 

(67) 

(x A x E ) = (x A x Bo )/V2 = y/{V 2 - l)/2 (68) 

one can show, using Eq. ([4]), that Eve's uncertainty on 
Alice's data is 



Va\e 



Fcosh2r 



1 



V + cosh 2r 



By choosing 



1 



cosh 2r 



(69) 



(70) 



this expression for Va\e coincides with Eq. (|3"Tj) . Com- 
bining Eq. (|6"5"|) with the relation cosh 2 2r — sinh 2 2r = 1 , 
we see that p must satisfy the second-order polynomial 
equation (f3"9")l . whose solution gives the value of p that 
optimizes Eve's information. Equation (|39f having two 
possible solutions p± generating the same quantum chan- 
nel (T, x) , we then have two possible solutions for the 
squeezing parameter r. Looking at Eq. ([7TJ|) . we see that 
that the squeezing parameter corresponding to the opti- 
mal choice p+ is the lowest of the two solutions since it 
corresponds to the minimum added noise on Eve's mea- 
surement. 



[e^i 0) 
r„r A (o) 



,-r-(0) 
3 X 2 

,-r»(0) 



]/V2 

}/V2. 



(60) 
(61) 



Eve then applies a Bell measurement by mixing E[ and 
Bo on a balanced beamsplitter, and measuring x on one 
output and p on the other, 

1 ra , a/ 1 1 .» 1[ r -(0) -r-(0)i 

Next, Eve displaces her mode E' 2 by an amount propor- 
tional to the measurement outcome X% (multiplied by 
the classical gain g B ) and sends it to Bob, giving 



x B = x 2 + g E x E M 
e r 



9E 4 



1+^ 



x(0) 



_ 1-^ 

V2 L v/2 



,(0) 



In order to comply with (x B ) 
gE and r in such a way that 



(63) 

T(V + x)i we need to fix 



9E = V2T (64) 
Tx = (1 + T) cosh 2r + 2VT sinh 2r. (65) 



2. Reverse reconciliation. 
Using Eqs. ©, ([67]), and 

(xb^b) = -p [V\/r + sinh 2r + Vr cosh 2r], (71) 
v2 

one can show that Eve's uncertainty on each of Bob's 
quadratures reads 



_ V cosh2r + 1 
k + cosh 2r 



(72) 



implying that the teleportation attack is also optimal 
(choosing the lowest squeezing parameter) for the reverse 
reconciliation protocol. 



B. Feed- forward attack 

In the case of a noisy channels with no losses (T = 1) 
and direct reconciliation, Eve's optimal teleportation at- 
tack is exactly the same scheme as the one proposed 
in Ref. 0] to reach an optimal tradeoff between distur- 
bance and state estimation for coherent states (when 
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FIG. 6: Entanglement based scheme of Eve "feed-forward" at- 
tack over the protocol based on Alice sending coherent states 
and Bob applying heterodyne detection. Eve extract part of 
the signal sent by Alice using a beamsplitter (transmittance 
G) and applies en heterodyne detection on it. Depending 
on the measurement result times a given fixed gain §e Eve 
displaces mode E' 2 over x (D x ) and p (Dp). The resulting 
state is then sent to Bob. By tuning the transmittance of 
the beamsplitter (G) and the gain (<?s) Eve can simulate any 
Gaussian channel (T, \) an d extract the optimal amount of 
information. 



the success of both processes is measured using the fi- 
delity). This is not surprising since optimally estimat- 
ing the coherent state sent by Alice while minimizing 
its disturbance is exactly what Eve attempts to achieve 
in her optimal attack in direct reconciliation. In Ref. [9j , 
two alternative schemes to the teleportation reaching the 
same optimal tradeoff were also presented, the "feed- 
forward" attack and the asymmetric cloning machine. 
Those two schemes can very naturally be extended to 
our case (T < 1) if we allow for different mean values 
for the input and output modes, which gives rise to new 
optical schemes for the optimal attack. 

For example, it can be checked that Eve can realize 
an optimal attack (both in DR and RR) using the "feed- 
forward" scheme described in Fig. [5] by fixing the pa- 
rameters of the beamsplitter transmittance G and the 
feed-forward gain gE as 



G 



flE 



1 



P+ 



l + p+ 

(Vt-Vg) 



l-G 



(73) 
(74) 



CONCLUSION 



Alice sending coherent states and Bob performing het- 
erodyne measurements) introduced in Ref. [4J. We have 
considered the most general Gaussian individual attack 
against this protocol by characterizing an arbitrary sym- 
plectic transformation and maximizing Eve's information 
over all such transformations. We have found that, in 
contrast with all other Gaussian protocols that had been 
studied so far, no attack exists that attains the security 
bounds deduced from the Heisenberg uncertainty rela- 
tions, making these bounds unreachable in the present 
case. A tight bound was derived, both in direct and re- 
verse reconciliation, and several explicit optical schemes 
that attain this bound have been exhibited. Remarkably, 
this makes the coherent-state heterodyne-based Gaussian 
protocol better than what was implicitly assumed in the 
original analysis [4|. 

We may wonder what is so special about this no- 
switching protocol? As a matter of fact, in the two 
Gaussian protocols based on homodyne detection, one 
of the two quadratures plays a special role, namely the 
one that is measured by Bob (provided, in the squeezed- 
state protocol, that it is also the one modulated by Al- 
ice; otherwise the instance is discarded). The Heisen- 
berg uncertainty relations then express that any action 
on this quadrature, which carries the key, translates into 
some additional noise on the dual quadrature. Monitor- 
ing the noise on this dual quadrature then puts an upper 
limit on the information potentially acquired by Eve on 
the key-carrying quadrature. This simple and very intu- 
itive interpretation fails for the heterodyne-based proto- 
col because then both quadratures must be treated to- 
gether (Alice modulates both quadratures and Bob mea- 
sures both quadratures). The security can be viewed as 
resulting from kind of an information conservation law 
through a "fan-out" channel (leading to both Bob and 
Eve) , akin to what is observed in the optimal cstimation- 
vs-disturbance tradeoff for coherent states @ or in the 
asymmetric Gaussian cloning of coherent states [l(| • 
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We have revisited the security of the Gaussian quan- 
tum cryptographic protocol with no basis switching (with 



Note added: The findings of this paper have also been 
obtained simultaneously and independently in [Til ] . 
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